2020Search,SpywareBlaster,AOLSpywareProtectiond C

Discussion in 'SpywareBlaster & Other Forum' started by HardLuckMike, May 24, 2004.

Thread Status:
Not open for further replies.
  1. HardLuckMike

    HardLuckMike Registered Member

    Joined:
    May 24, 2004
    Posts:
    4
    I have the latest versions and definitions of spywareblaster, spybot, adaware, and "AOL Spyware Protection. I use XP HOME SP1, all critical and other updates installed.
    I have all protection enabled in Spywareblaster, and i scan with adaware and Spybot about once a week.
    If i run "AOL Spyware Protection" (made by Aluria software), it always comes up with 1 item: 2020Search.
    I had "AOL Spyware Protection" block the "2020 Search" items, I open up spywarebalster and there are now 4 items unchecked in the Restricted sites - Block List:

    offshoreclicks.com
    i.lookup.com
    xxxtoolbard.com
    teensguru.com

    , and there were none before I quarentine the 2020Search with the "AOL Spyware Protection".

    Below is the "AOL Spyware Protectuion" Log file:

    ASP Version: 1.0.66 Definition Date: 05-04-04 Date: 5/18/2004 9:43:17 PM
    Action: Found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\teensguru.com
    Spyware Name: 2020Search
    *****************

    ASP Version: 1.0.66 Definition Date: 05-04-04 Date: 5/18/2004 9:43:17 PM
    Action: Found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xxxtoolbar.com
    Spyware Name: 2020Search
    *****************

    ASP Version: 1.0.66 Definition Date: 05-04-04 Date: 5/18/2004 9:43:17 PM
    Action: Found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\i-lookup.com
    Spyware Name: 2020Search
    *****************

    ASP Version: 1.0.66 Definition Date: 05-04-04 Date: 5/18/2004 9:43:17 PM
    Action: Found: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\offshoreclicks.com
    Spyware Name: 2020Search
    *****************

    Notice that those *same* 4 files appear in the "AOL Spyware Protection" log that have been disabled in the SpywareBlaster Restricted Sites Block list.

    Is the "kill byte" cause this problem?
    Why does the Restricted Sites-Block List get unchecked?
    Is this a bug in SpywareBlaster?

    .
     
    HardLuckMike, May 24, 2004
    #1
  2. LowWaterMark

    LowWaterMark Administrator

    Joined:
    Aug 10, 2002
    Posts:
    18,280
    Location:
    New England
    Actually, this is not unusual. Some scanning software mistakenly alerts to spyware by simply flagging items contained in the ..\ZoneMap\Domains area of the registry, when in fact they really need to check the value set on those specific keys and not just assume a hijack.

    You see, all four of those items are IE restricted site entries which are added by SpywareBlaster (and some other spyware protection products). They are added to the registry properly with a value of "4" (which means they are restricted sites in IE). That scanner is simply seeing that there are entries for those four names, but is not properly checking them to see that they are restricted. In short, those are false positives by that scanner and they would need to fix their scanner to not remove those entries.

    When you have it fix those four items, and they get removed (as noted by checking the list again in SpywareBlaster) you have removed protections, not added any protection.
     
    LowWaterMark, May 24, 2004
    #2
Thread Status:
Not open for further replies.
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...